@jmruthers/pace-core 0.2.4

package/src/types/security.ts

@@ -0,0 +1,70 @@
+
+/**
+ * @file Security-related Types
+ * @description Type definitions for security features
+ */
+
+export interface SecurityConfig {
+  /** Enable device fingerprinting */
+  deviceFingerprinting: boolean;
+  /** Enable CSRF protection */
+  csrfProtection: boolean;
+  /** Password validation level */
+  passwordValidation: 'basic' | 'strict';
+  /** Session timeout in milliseconds */
+  sessionTimeout: number;
+  /** Maximum login attempts before lockout */
+  maxLoginAttempts: number;
+  /** Rate limit window in milliseconds */
+  rateLimitWindow: number;
+}
+
+export interface SecurityMetrics {
+  /** Number of failed authentication attempts */
+  failedAttempts: number;
+  /** Last login timestamp */
+  lastLogin: number;
+  /** Device trust score (0-100) */
+  deviceTrustScore: number;
+  /** Session risk level */
+  riskLevel: 'low' | 'medium' | 'high' | 'critical';
+}
+
+export interface SecurityEvent {
+  /** Event type */
+  type: 'login_attempt' | 'login_success' | 'login_failure' | 'permission_denied' | 'suspicious_activity';
+  /** User ID (if known) */
+  userId?: string;
+  /** Session ID */
+  sessionId?: string;
+  /** Event timestamp */
+  timestamp: number;
+  /** Event details */
+  details: Record<string, unknown>;
+  /** Risk level */
+  riskLevel: SecurityMetrics['riskLevel'];
+  /** IP address (hashed for privacy) */
+  ipHash?: string;
+  /** User agent hash */
+  userAgentHash?: string;
+}
+
+export interface RateLimitConfig {
+  /** Maximum attempts allowed */
+  maxAttempts: number;
+  /** Time window in milliseconds */
+  windowMs: number;
+  /** Penalty multiplier for repeated violations */
+  penaltyMultiplier: number;
+}
+
+export interface SecurityAuditLog {
+  /** Unique audit entry ID */
+  id: string;
+  /** Event that was audited */
+  event: SecurityEvent;
+  /** Action taken (if any) */
+  action?: 'blocked' | 'warned' | 'logged' | 'escalated';
+  /** Additional context */
+  context?: Record<string, unknown>;
+}

package/src/types/supabase.ts

@@ -0,0 +1,166 @@
+/**
+ * @file Supabase Integration Types
+ * 
+ * TypeScript interfaces for Supabase client operations with standard types.
+ */
+
+import type {
+  User,
+  Session,
+  AuthError,
+  PermissionError,
+  UserPermissions,
+  AccessLevel,
+  PermissionString,
+} from './unified';
+
+import type { SupabaseClient } from '@supabase/supabase-js';
+
+/**
+ * Standard Supabase client - no custom wrapper needed
+ */
+export type TypedSupabaseClient<Database = unknown> = SupabaseClient<Database>;
+
+/**
+ * Standard query result wrapper
+ */
+export interface QueryResult<T = unknown> {
+  data: T | null;
+  error: unknown | null;
+  count?: number | null;
+  status: number;
+  statusText: string;
+}
+
+// ============================================================================
+// AUTH OPERATIONS
+// ============================================================================
+
+/**
+ * Authentication operations interface
+ */
+export interface AuthOperations {
+  signIn(email: string, password: string): Promise<{ data: { user: User; session: Session } | null; error: AuthError | null }>;
+  signUp(email: string, password: string): Promise<{ data: { user: User } | null; error: AuthError | null }>;
+  signOut(): Promise<{ error: AuthError | null }>;
+  getSession(): Promise<{ data: { session: Session } | null; error: AuthError | null }>;
+  refreshSession(): Promise<{ data: { session: Session } | null; error: AuthError | null }>;
+  resetPassword(email: string): Promise<{ data: unknown; error: AuthError | null }>;
+  updateUser(attributes: Partial<User>): Promise<{ data: { user: User } | null; error: AuthError | null }>;
+}
+
+// ============================================================================
+// PERMISSION OPERATIONS
+// ============================================================================
+
+/**
+ * Permission operations interface
+ */
+export interface PermissionOperations {
+  getUserPermissions(
+    userId: string,
+    eventId: string,
+    appName: string
+  ): Promise<{ data: UserPermissions | null; error: PermissionError | null }>;
+
+  checkPermission(
+    userId: string,
+    permission: PermissionString,
+    eventId: string,
+    appName: string
+  ): Promise<{ data: { granted: boolean } | null; error: PermissionError | null }>;
+
+  grantPermission(
+    userId: string,
+    permission: PermissionString,
+    eventId: string,
+    appName: string
+  ): Promise<{ data: null; error: PermissionError | null }>;
+
+  revokePermission(
+    userId: string,
+    permission: PermissionString,
+    eventId: string,
+    appName: string
+  ): Promise<{ data: null; error: PermissionError | null }>;
+
+  setUserAccessLevel(
+    userId: string,
+    accessLevel: AccessLevel,
+    eventId: string,
+    appName: string
+  ): Promise<{ data: null; error: PermissionError | null }>;
+}
+
+// ============================================================================
+// UTILITY TYPES
+// ============================================================================
+
+/**
+ * Supabase table names for type safety
+ */
+export type TableName = 
+  | 'users'
+  | 'rbac_global_roles'
+  | 'rbac_organisation_roles'
+  | 'rbac_event_app_roles'
+  | 'rbac_page_permissions'
+  | 'rbac_user_sessions'
+  | 'rbac_user_profiles'
+  | 'rbac_user_login_history'
+  | 'event'
+  | 'organisations'
+
+  | 'rbac_apps';
+
+/**
+ * Supabase RPC function names
+ */
+export type RPCFunction = 
+  | 'get_rbac_permissions'
+  | 'get_user_app_permissions'
+  | 'get_user_current_roles'
+  | 'get_user_event_access'
+  | 'get_user_events'
+  | 'get_user_organisations'
+  | 'get_user_organisation_ids'
+  | 'get_user_effective_organisations'
+  | 'get_app_config'
+  | 'get_organisation_apps'
+  | 'get_organisation_hierarchy'
+  | 'grant_user_role'
+  | 'revoke_user_role'
+  | 'grant_direct_app_access'
+  | 'revoke_direct_app_access'
+  | 'check_page_permission'
+  | 'has_organisation_permission'
+  | 'has_organisation_role'
+  | 'user_has_role_in_org'
+  | 'user_has_min_role_in_org'
+  | 'can_access_event'
+  | 'can_access_organisation'
+  | 'is_super_admin'
+  | 'is_admin'
+  | 'track_user_session'
+  | 'record_user_login'
+  | 'log_organisation_access'
+  | 'log_medi_access'
+  | 'get_pace_user_events';
+
+/**
+ * Helper type for Supabase filter operations
+ */
+export interface SupabaseFilter {
+  column: string;
+  operator: 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'like' | 'ilike' | 'in' | 'is';
+  value: unknown;
+}
+
+/**
+ * Helper type for Supabase order operations
+ */
+export interface SupabaseOrder {
+  column: string;
+  ascending?: boolean;
+  nullsFirst?: boolean;
+}

package/src/types/theme.ts

@@ -0,0 +1,6 @@
+/**
+ * @file Theme-related types
+ * Re-exports from unified types to maintain backward compatibility
+ */
+
+export type { ThemeColors, EventTheme } from './unified'; 

package/src/types/unified.ts

@@ -0,0 +1,262 @@
+/**
+ * @file Unified types for PACE Core
+ * @package @jmruthers/pace-core
+ * @module unified
+ * @since 0.1.0
+ */
+
+/**
+ * @file Unified Types for DataTable
+ * @package @jmruthers/pace-core
+ * @module Types
+ * @since 0.3.0
+ */
+
+// Authentication Error Codes
+export enum AuthErrorCode {
+  UNKNOWN_ERROR = 'UNKNOWN_ERROR',
+  INVALID_CREDENTIALS = 'INVALID_CREDENTIALS',
+  USER_NOT_FOUND = 'USER_NOT_FOUND',
+  EMAIL_NOT_CONFIRMED = 'EMAIL_NOT_CONFIRMED',
+  PASSWORD_TOO_WEAK = 'PASSWORD_TOO_WEAK',
+  WEAK_PASSWORD = 'WEAK_PASSWORD',
+  RATE_LIMITED = 'RATE_LIMITED',
+  RATE_LIMIT_EXCEEDED = 'RATE_LIMIT_EXCEEDED',
+  SESSION_EXPIRED = 'SESSION_EXPIRED',
+  PERMISSION_DENIED = 'PERMISSION_DENIED',
+  NETWORK_ERROR = 'NETWORK_ERROR'
+}
+
+// Permission Error Codes
+export enum PermissionErrorCode {
+  INSUFFICIENT_PERMISSIONS = 'INSUFFICIENT_PERMISSIONS',
+  INVALID_PERMISSION = 'INVALID_PERMISSION',
+  PERMISSION_CHECK_FAILED = 'PERMISSION_CHECK_FAILED',
+  ACCESS_DENIED = 'ACCESS_DENIED'
+}
+
+// Access Levels - using lowercase to match test expectations
+export enum AccessLevel {
+  NONE = 'none',
+  VIEWER = 'viewer',
+  PARTICIPANT = 'participant',
+  EDITOR = 'editor',
+  PLANNER = 'planner',
+  ADMIN = 'admin',
+  SUPER_ADMIN = 'super_admin',
+  SUPER = 'super'
+}
+
+// Branded Types
+export type UserId = string & { __brand: 'UserId' };
+export type SessionToken = string & { __brand: 'SessionToken' };
+export type PermissionString = string & { __brand: 'PermissionString' };
+export type RequestId = string & { __brand: 'RequestId' };
+
+// Branded Type Creators
+export function createUserId(id: string): UserId {
+  return id as UserId;
+}
+
+export function createSessionToken(token: string): SessionToken {
+  return token as SessionToken;
+}
+
+export function createPermissionString(permission: string): PermissionString {
+  return permission as PermissionString;
+}
+
+export function createRequestId(id: string): RequestId {
+  return id as RequestId;
+}
+
+// Type Guards for branded types
+export function isUserId(value: unknown): value is UserId {
+  return typeof value === 'string' && value.length > 0;
+}
+
+export function isSessionToken(value: unknown): value is SessionToken {
+  return typeof value === 'string' && value.length > 0;
+}
+
+export function isPermissionString(value: unknown): value is PermissionString {
+  if (typeof value !== 'string' || value.length === 0) return false;
+  // Basic validation for permission format (resource:action)
+  return value.includes(':') && value.split(':').length === 2;
+}
+
+export function isRequestId(value: unknown): value is RequestId {
+  return typeof value === 'string' && value.length > 0;
+}
+
+// Permission Types
+export type PermissionMap = Record<string, boolean>;
+
+// Permission Context
+export interface PermissionContext {
+  eventId?: string;
+  appName?: string;
+  userId?: string;
+}
+
+// Auth Error Interface - Define locally to avoid circular dependency
+export interface AuthError extends Error {
+  __isAuthError: true;
+  name: 'AuthError';
+  message: string;
+  code: AuthErrorCode;
+  user_message: string;
+  timestamp: number;
+}
+
+// Permission Error Interface
+export interface PermissionError extends Error {
+  __isPermissionError: true;
+  name: 'PermissionError';
+  message: string;
+  code: PermissionErrorCode;
+  timestamp: number;
+}
+
+// Theme Types - Consolidated from theme.ts
+export interface ThemeColors {
+  primary: string;
+  secondary: string;
+  hover?: string;
+  active?: string;
+  bgSoft?: string;
+}
+
+export interface EventTheme {
+  mid: ThemeColors;
+  light: ThemeColors;
+}
+
+// Event Types - Updated to match database schema exactly with organisation context
+export interface Event {
+  // Primary identification
+  id: string;
+  event_id: string;
+  event_name: string;
+  event_code?: string;
+  
+  // Organisation context - MANDATORY for security
+  organisation_id: string;
+  
+  // Event details
+  event_date?: string; // Use event_date from database for proper sorting
+  event_days?: number;
+  event_venue?: string;
+  event_participants?: number;
+  is_visible?: boolean;
+  
+  // Visual branding
+  event_logo?: string;
+  event_colours?: Record<string, unknown> | null; // JSONB field for theme colors
+  event_col_d1?: string;
+  event_col_d2?: string;
+  event_col_m1?: string;
+  event_col_m2?: string;
+  event_col_l1?: string;
+  event_col_l2?: string;
+  
+  // Additional metadata
+  event_news?: string;
+  event_billing?: string;
+  event_catering_email?: string;
+  event_email?: string;
+  event_footer?: string;
+  event_rounddown?: number;
+  event_youthmultiplier?: number;
+  event_typicalunit?: number;
+  
+  // Timestamps
+  created_at: string;
+  updated_at: string;
+  created_by?: string;
+  updated_by?: string;
+  
+  // Legacy compatibility
+  name?: string; // Alias for event_name
+  description?: string;
+  start_date?: string; // Alias for event_date
+  end_date?: string;
+  theme_colors?: EventTheme;
+}
+
+// Event Context Type
+export interface EventContextType {
+  selectedEvent: Event | null;
+  currentEvent: Event | null; // Added missing property
+  events: Event[];
+  isLoading: boolean;
+  error: string | null;
+  selectEvent: (event: Event) => void;
+  setCurrentEvent: (event: Event | null) => void; // Added missing property
+  clearSelection: () => void;
+  refreshEvents: () => Promise<void>;
+  createEvent: (event: Partial<Event>) => Promise<Event>;
+  updateEvent: (id: string, updates: Partial<Event>) => Promise<Event>;
+  deleteEvent: (id: string) => Promise<void>;
+}
+
+// RBAC Types
+export interface UserPermissions {
+  user_id: UserId;
+  accessLevel: AccessLevel;
+  permissions: PermissionMap;
+  roles: string[];
+}
+
+// Re-export standard Supabase types for consistency
+// Note: These are the same as what's in @supabase/supabase-js
+export interface User {
+  id: string;
+  email?: string;
+  created_at: string;
+  updated_at: string;
+  email_confirmed_at?: string;
+  last_sign_in_at?: string;
+  user_metadata?: Record<string, unknown>;
+  app_metadata?: Record<string, unknown>;
+}
+
+export interface Session {
+  access_token: string;
+  refresh_token?: string;
+  expires_in: number;
+  expires_at: number;
+  token_type: string;
+  user: User;
+  provider_token?: string;
+  provider_refresh_token?: string;
+}
+
+export interface DataRecord {
+  id: string | number;
+  [key: string]: unknown;
+}
+
+export interface DataTableAction<T = unknown> {
+  label: string;
+  onClick: (row: T) => void;
+  testId?: string;
+  disabled?: boolean | ((row: T) => boolean);
+  variant?: 'primary' | 'secondary' | 'destructive';
+}
+
+export interface DataTableColumn<T = unknown> {
+  id?: string;
+  key: string;
+  label: string;
+  sortable?: boolean;
+  filterable?: boolean;
+  accessorKey?: keyof T;
+  accessorFn?: (row: T) => unknown;
+  cell?: (value: unknown, row: T) => React.ReactNode;
+  header?: React.ReactNode;
+  enableSorting?: boolean;
+  enableColumnFilter?: boolean;
+  enableGrouping?: boolean;
+  enableHiding?: boolean;
+}

package/src/types/validation.ts

@@ -0,0 +1,164 @@
+/**
+ * @file Validation Types
+ * @package @jmruthers/pace-core
+ * @module Types/Validation
+ * @since 0.1.0
+ * 
+ * Consolidated validation types and interfaces for the PACE Core library.
+ * This file contains all validation-related type definitions.
+ */
+
+import { z } from 'zod';
+
+// ============================================================================
+// Core Validation Interfaces
+// ============================================================================
+
+export interface ValidationError {
+  field: string;
+  message: string;
+  code: string;
+}
+
+export interface ValidationResult<T = unknown> {
+  success: boolean;
+  data?: T;
+  errors?: ValidationError[];
+}
+
+// ============================================================================
+// Form Value Types
+// ============================================================================
+
+// Basic form schemas
+export const emailSchema = z.string().email('Please enter a valid email address');
+export const nameSchema = z.string().min(1, 'Name is required').max(100, 'Name must be less than 100 characters');
+export const phoneSchema = z.string().regex(/^\+?[\d\s\-\(\)]+$/, 'Please enter a valid phone number');
+export const urlSchema = z.string().url('Please enter a valid URL');
+export const dateSchema = z.string().refine((date) => !isNaN(Date.parse(date)), 'Please enter a valid date');
+
+// Password schemas
+export const passwordSchema = z.string()
+  .min(8, 'Password must be at least 8 characters')
+  .regex(/[A-Z]/, 'Password must contain at least one uppercase letter')
+  .regex(/[a-z]/, 'Password must contain at least one lowercase letter')
+  .regex(/[0-9]/, 'Password must contain at least one number');
+
+export const securePasswordSchema = passwordSchema
+  .regex(/[!@#$%^&*(),.?":{}|<>]/, 'Password must contain at least one special character');
+
+// Auth schemas
+export const loginSchema = z.object({
+  email: emailSchema,
+  password: z.string().min(1, 'Password is required'),
+});
+
+export const registrationSchema = z.object({
+  email: emailSchema,
+  password: passwordSchema,
+  confirmPassword: z.string(),
+}).refine((data) => data.password === data.confirmPassword, {
+  message: "Passwords don't match",
+  path: ["confirmPassword"],
+});
+
+export const secureLoginSchema = z.object({
+  email: emailSchema,
+  password: securePasswordSchema,
+});
+
+export const passwordResetSchema = z.object({
+  email: emailSchema,
+});
+
+export const changePasswordSchema = z.object({
+  currentPassword: z.string().min(1, 'Current password is required'),
+  newPassword: securePasswordSchema,
+  confirmPassword: z.string(),
+}).refine((data) => data.newPassword === data.confirmPassword, {
+  message: "Passwords don't match",
+  path: ['confirmPassword'],
+});
+
+// User schemas
+export const userProfileSchema = z.object({
+  name: nameSchema,
+  email: emailSchema,
+  phone: phoneSchema.optional(),
+  website: urlSchema.optional(),
+  bio: z.string().max(500).optional(),
+});
+
+// Contact form schema
+export const contactFormSchema = z.object({
+  name: nameSchema,
+  email: emailSchema,
+  message: z.string().min(1, 'Message is required').max(1000, 'Message must be less than 1000 characters'),
+});
+
+// ============================================================================
+// Inferred Types
+// ============================================================================
+
+export type LoginFormValues = z.infer<typeof loginSchema>;
+export type RegistrationFormValues = z.infer<typeof registrationSchema>;
+export type PasswordResetFormValues = z.infer<typeof passwordResetSchema>;
+export type ChangePasswordFormValues = z.infer<typeof changePasswordSchema>;
+export type UserProfileFormValues = z.infer<typeof userProfileSchema>;
+
+// Secure form types (with CSRF protection)
+export type SecureLoginFormValues = {
+  email: string;
+  password: string;
+  csrfToken?: string;
+};
+
+export type SecureRegistrationFormValues = {
+  email: string;
+  password: string;
+  confirmPassword: string;
+  csrfToken?: string;
+};
+
+export type SecurePasswordResetFormValues = {
+  email: string;
+  csrfToken?: string;
+};
+
+// ============================================================================
+// Utility Types
+// ============================================================================
+
+export type FormData = LoginFormData | RegistrationFormData | ProfileFormData | ContactFormData;
+
+export type LoginFormData = z.infer<typeof loginSchema>;
+export type RegistrationFormData = z.infer<typeof registrationSchema>;
+export type ProfileFormData = z.infer<typeof userProfileSchema>;
+export type ContactFormData = z.infer<typeof contactFormSchema>;
+
+// ============================================================================
+// Schema Utility Functions
+// ============================================================================
+
+export function pickSchema<T extends z.ZodObject<any, any, any>, K extends keyof z.infer<T>>(
+  schema: T,
+  keys: K[]
+): z.ZodObject<Pick<z.infer<T>, K>> {
+  const shape = Object.entries(schema.shape)
+    .filter(([key]) => keys.includes(key as K))
+    .reduce((acc, [key, value]) => {
+      (acc as Record<string, unknown>)[key] = value as unknown;
+      return acc;
+    }, {} as Record<string, unknown>);
+
+  return z.object(shape as Record<string, z.ZodTypeAny>) as z.ZodObject<Pick<z.infer<T>, K>>;
+}
+
+export function combineSchemas<T extends z.ZodObject<any, any, any>[]>(
+  schemas: T
+): z.ZodObject<any, any, any> {
+  return schemas.reduce(
+    (merged, schema) => merged.merge(schema),
+    z.object({})
+  );
+}